AllowOrigin (single string) is replaced by AllowOrigins ([]string).
The router now matches the request Origin header against the list,
echoes the matched origin back, and sets Vary: Origin for non-wildcard
matches. Non-matching origins receive no CORS headers.